question-mark
Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

More flexible CORS support in core, to encourage good security practices

See original GitHub issue

It would be nice if the --cors option accepted an origin regex to more securely allow secure local development.

As an example, Observable notebooks namespace every user’s notebooks by their username and user content is served from username.observableusercontent.com, so you would set --cors-origin username.observableusercontent.com to restrict access to a local development Datasette instance to only your own notebooks, rather than exposing the data to any website that makes a request.

Thank you for all of your work on Datasette!

Issue Analytics

  • State:open
  • Created 3 years ago
  • Comments:6 (5 by maintainers)

github_iconTop GitHub Comments

2reactions
simonwcommented, Dec 16, 2020

I think the right way to do this is to support multiple optional --cors-origin= pattern values, like you suggested.

1reaction
simonwcommented, Dec 14, 2020

This may involve a breaking change to the CLI settings interface, so I’m adding this to the 1.0 milestone.

Read more comments on GitHub >

github_iconTop Results From Across the Web

How to Avoid CORS Security Issues in 2021 | Cross-Origin ...
We have recently identified critical cross-origin resource sharing (CORS) vulnerabilities for a number of clients. Here are the key mistakes ...
Read more >
Enable Cross-Origin Requests (CORS) in ASP.NET Core
This article shows how to enable CORS in an ASP.NET Core app. Browser security prevents a web page from making requests to a...
Read more >
Bountysource
More flexible CORS support in core, to encourage good security practices.
Read more >
Chapter 6. Best practices - CORS in Action - liveBook · Manning
The goal of this chapter is to build a flexible CORS server that can be used with a variety of configurations. To do...
Read more >
Secretary-General's Initiative on Action for Peacekeeping
A4P: Our core agenda for Peacekeeping ... Member States are encouraged to support A4P by focusing on their ... Read more about women,...
Read more >

github_iconTop Related Medium Post

No results found

github_iconTop Related StackOverflow Question

No results found

github_iconTroubleshoot Live Code

Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free

github_iconTop Related Reddit Thread

No results found

github_iconTop Related Hackernoon Post

No results found

github_iconTop Related Tweet

No results found

github_iconTop Related Dev.to Post

No results found

github_iconTop Related Hashnode Post

No results found